In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: MGMT: Fix adv monitor add failure cleanup<\/p>\n
hci_add_adv_monitor() publishes a new adv_monitor in
\nhdev->adv_monitors_idr before the powered MSFT setup step. The MSFT
\noffload add path can then fail either locally before the controller add
\ncommand completes, or in the MSFT add callback. In the current queued
\nmanagement add flow, hci_cmd_sync_work() still invokes
\nmgmt_add_adv_patterns_monitor_complete() with the original pending command
\nafter msft_add_monitor_pattern() returns.<\/p>\n
The buggy scenario involves two paths, with each column showing the order
\nwithin that path:<\/p>\n
MSFT add handling MGMT completion
\n1. insert monitor and handle 1. receive sync error
\n2. send MSFT add command 2. call add-monitor completion
\n3. callback sees bad response 3. load cmd->user_data
\n4. callback frees monitor 4. read monitor->handle<\/p>\n
Local MSFT setup failures have the other half of the same ownership bug:
\nthey return an error after the IDR insertion, but no later code removes the
\nfailed monitor from the IDR.<\/p>\n
Keep ownership with the pending management command until its completion.
\nFor normal management adds, the MSFT add callback now records successful
\ncontroller state and returns errors to its caller. The management
\ncompletion frees the monitor on non-success after copying the response
\nhandle, while resume\/reregister callback-error cleanup remains in the
\nMSFT callback. The success path keeps the existing bookkeeping.<\/p>\n
Validation reproduced this kernel report:
\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb\/0x260 [bluetooth]<\/p>\n
Call Trace:<\/p>\n
dump_stack_lvl+0x66\/0xa0
\n print_report+0xce\/0x5f0
\n ? mgmt_add_adv_patterns_monitor_complete+0xfb\/0x260 [bluetooth]
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? __virt_addr_valid+0x19f\/0x330
\n ? mgmt_add_adv_patterns_monitor_complete+0xfb\/0x260 [bluetooth]
\n kasan_report+0xe0\/0x110
\n ? mgmt_add_adv_patterns_monitor_complete+0xfb\/0x260 [bluetooth]
\n mgmt_add_adv_patterns_monitor_complete+0xfb\/0x260 [bluetooth]
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? 0xffffffffc00d00da
\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10\/0x10 [bluetooth]
\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10\/0x10 [bluetooth]
\n ? hci_cmd_sync_work+0x1ab\/0x210 [bluetooth]
\n hci_cmd_sync_work+0x1c0\/0x210 [bluetooth]
\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10\/0x10 [bluetooth]
\n process_one_work+0x4fd\/0xbc0
\n ? __pfx_process_one_work+0x10\/0x10
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? __list_add_valid_or_report+0x37\/0xf0
\n ? __pfx_hci_cmd_sync_work+0x10\/0x10 [bluetooth]
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n worker_thread+0x2d8\/0x570
\n ? __pfx_worker_thread+0x10\/0x10
\n kthread+0x1ad\/0x1f0
\n ? __pfx_kthread+0x10\/0x10
\n ret_from_fork+0x3c9\/0x540
\n ? __pfx_ret_from_fork+0x10\/0x10
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? __switch_to+0x2e9\/0x730
\n ? __pfx_kthread+0x10\/0x10
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
Allocated by task 471 on cpu 3 at 285.205389s:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x17\/0x60
\n __kasan_kmalloc+0xaa\/0xb0
\n add_adv_patterns_monitor_rssi+0xd5\/0x230 [bluetooth]
\n hci_sock_sendmsg+0x96b\/0xf80 [bluetooth]
\n __sys_sendto+0x2bc\/0x2d0
\n __x64_sys_sendto+0x76\/0x90
\n do_syscall_64+0x115\/0x6a0
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
Freed by task 454 on cpu 2 at 285.217112s:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x17\/0x60
\n kasan_save_free_info+0x3b\/0x60
\n __kasan_slab_free+0x5f\/0x80
\n kfree+0x313\/0x590
\n msft_add_monitor_sync+0x54a\/0x570 [bluetooth]
\n hci_add_adv_monitor+0x133\/0x180 [bluetooth]
\n hci_cmd_sync_work+0x187\/0x210 [bluetooth]
\n process_one_work+0x4fd\/0xbc0
\n worker_thread+0x2d8\/0x570
\n kthread+0x1ad\/0x1f0
\n ret_from_fork+0x3c9\/0x540
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: MGMT: Fix adv monitor add failure cleanup<\/p>\n
hci_add_adv_monitor() publishes a new adv_monitor in
\nhdev->adv_monitors_idr b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6963","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}